Method and apparatus for digital forensics

Abstract

A method and apparatus for digital forensics are provided. The apparatus for digital forensics includes a page file extractor for extracting a page file stored in a target storage medium, a stored-page feature extractor for extracting features of pages stored in the extracted page file, a page classifier for comparing the extracted features of the pages with at least one predetermined classification criterion and classifying the pages according to the comparison results, and a digital forensics unit for performing digital forensics according to the classified pages. According to the method and apparatus, it is possible to perform digital forensics using only information of a page file.

Description

CROSS-REFERENCE TO RELATED APPLICATION[0001]This application claims priority to and the benefit of Korean Patent Application No. 2008-51716, filed Jun. 2, 2008, the disclosure of which is incorporated herein by reference in its entirety.BACKGROUND[0002]1. Field of the Invention[0003]The present invention relates to a method and apparatus for digital forensics, and more particularly, to a method and apparatus for digital forensics capable of obtaining detailed information using a feature of data used as a virtual memory in a computing environment.[0004]2. Discussion of Related Art[0005]Digital forensics is the field of finding important evidence using computer-generated information in criminal investigations. With the development of information technology, most information is being digitized. Thus, in criminal investigations, the sources of evidence and information are changing from analog media such as documents to digital media such as computer hard disks.[0006]However, since digit...

AI Technical Summary

Benefits of technology

[0016]The page file may include a kernel space data storage and a user space data storage, and the user space data storage may include at least one execution section and at least one heap / stack section. The target storage medium may be a data storage medium capable of saving the stored page file even if power is cut off.

Problems solved by technology

However, since digital information has the property of being easily deleted, it is difficult to obtain relevant evidence.

Thus, it is impossible to obtain the management information on the stored pages from the page file alone.

In other words, in conventional digital forensics, only strings can be extracted from the page file due to lack of available data related to the page file.

Consequently, a password, a Uniform Resource Locator (URL) and an email address can be extracted by string searching, but it is impossible to extract further information.

Images